refactor: strict exported-above-unexported ordering (fat12, images handler)

Two declaration-order fixes for the "exported above unexported" rule that #67's
follow-up (8518acf) left, both respecting "const block at top (after imports)":

- metadata/fat12.go: hoist exported CreateFAT12 above newFAT12Builder + the
  fat12Builder method group.
- cmd/images/handler.go: keep the mixed const block at top (config.go-style
  const-first, since it holds a plain const + typed enum values), then hoist
  exported Handler above the unexported imageType/importSourceKind/importLocalPlan.

Pure relocation, no behavior change. Verified project-wide: 0 exported-standalone-
after-unexported, 0 exported-type-after-unexported, 0 AST layout violations across
236 files; const/var blocks at top everywhere except the SKILL-sanctioned
typed-const grouping (type X then its const block). build/vet/lint (darwin+linux)
+ race tests green.

Author: CMGS

cmd/images/handler.go

@@ -2,10 +2,6 @@ package images
 
 import cmdcore "github.com/cocoonstack/cocoon/cmd/core"
 
-type imageType int
-
-type importSourceKind int
-
 const (
 	// digestDisplayLen = len("sha256:") + 12 hex digits for compact display.
 	digestDisplayLen = 19
@@ -22,6 +18,10 @@ type Handler struct {
 	cmdcore.BaseHandler
 }
 
+type imageType int
+
+type importSourceKind int
+
 type importLocalPlan struct {
 	kind  importSourceKind
 	files []string

metadata/fat12.go

@@ -43,6 +43,19 @@ type fat12Builder struct {
 	shortSeq    int         // counter for ~N short-name suffixes
 }
 
+// CreateFAT12 streams a 1 MiB FAT12 image with VFAT long-filename support to w.
+// label is the volume label (e.g. "CIDATA"); files maps filename → content.
+func CreateFAT12(w io.Writer, label string, files map[string][]byte) error {
+	b := newFAT12Builder(label)
+
+	for _, name := range slices.Sorted(maps.Keys(files)) {
+		if err := b.addFile(name, files[name]); err != nil {
+			return err
+		}
+	}
+	return b.writeTo(w)
+}
+
 func newFAT12Builder(label string) *fat12Builder {
 	b := &fat12Builder{
 		label:       label,
@@ -195,19 +208,6 @@ func (b *fat12Builder) makeBootSector() []byte {
 	return boot
 }
 
-// CreateFAT12 streams a 1 MiB FAT12 image with VFAT long-filename support to w.
-// label is the volume label (e.g. "CIDATA"); files maps filename → content.
-func CreateFAT12(w io.Writer, label string, files map[string][]byte) error {
-	b := newFAT12Builder(label)
-
-	for _, name := range slices.Sorted(maps.Keys(files)) {
-		if err := b.addFile(name, files[name]); err != nil {
-			return err
-		}
-	}
-	return b.writeTo(w)
-}
-
 // setFATEntry writes a 12-bit value into the FAT at the given cluster index.
 func setFATEntry(fat []byte, cluster int, val uint16) {
 	off := cluster + cluster/2 //nolint:mnd